TOTOLINK A950RG CVE-2026-121599

Requires authenticated access to the router's HTTP management interface - the setWiFiMultipleConfig/delWiFiMultipleConfig endpoints in /cgi-bin/cstecgi.cgi are reached after login, consistent with PR:L - and the attacker must supply an oversized wepkey2 or wepkey3 argument to the Multi-SSID Configuration handler. Limiting factors: valid low-privilege web credentials are needed (not unauthenticated), the specific firmware 4.1.2cu.5268_B20221104 on the A950RG must be present, and network reachability to the management interface is required, which in default deployments is typically LAN-side rather than WAN-exposed. No user interaction is required (UI:N).

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack, but PR:L means valid low-privilege credentials (authenticated access to the router's web interface) are required - this is an authenticated flaw, not an unauthenticated one. The CVSS 4.0 score of 8.6 reflects high confidentiality/integrity/availability impact plus high subsequent-system impact, consistent with a stack-based buffer overflow (CWE-121) that can lead to code execution on the device. Exploitation maturity is E:P (Proof-of-Concept), and the input confirms the PoC is a reference only, not verified as working exploit code, so the 'exploit is now public' claim should be treated as a public PoC reference rather than a confirmed weaponized exploit. No CISA KEV listing and no EPSS score are provided, so there is no evidence of active exploitation and no modeled exploitation probability to weigh. The vendor-priority decision label is 'this_week', which aligns with a serious-but-not-emergency triage: patch promptly but it is not flagged act_now/emergency. Net: a real priority for anyone running this specific TOTOLINK model, tempered by the authentication requirement and the unverified PoC.

An attacker who already holds low-privilege access to the A950RG web management interface (e.g. default or weak credentials, or a session on the LAN) sends a crafted request to /cgi-bin/cstecgi.cgi invoking setWiFiMultipleConfig/delWiFiMultipleConfig with an overlong wepkey2 or wepkey3 value, overflowing a stack buffer in the Multi-SSID configuration handler. A public PoC reference exists (a GitHub gist) but is not verified as working exploit code. Successful exploitation can corrupt the stack to crash the service or execute attacker-controlled code on the router with the web service's privileges.